Extracted

• • Target

    af4b898d1f223c1c974b23336feb95e4cf471fefa7709c12c6e75c49af2459fc

  • Size

    1.9MB

  • MD5

    77da12955ea446d15ef66474a853c78b

  • SHA1

    22d658b427ab91da5c2eeb2d7f91466155b67031

  • SHA256

    af4b898d1f223c1c974b23336feb95e4cf471fefa7709c12c6e75c49af2459fc

  • SHA512

    1bd331387d1b0011e3614457c087046302b319a20f5a815c5a85d5618f64d790c9c3e9dd334ecaa40b794766b2013af4427d718ea9b1f43820ef0acf61e5655d

  • SSDEEP

    49152:kw6CXrPADC7J656KvP9ND/dMToGHSzCqUJTqeLimd:kw6C7MDHRMToGyKTd

  Score

  10^/10

  salitybackdoordefense_evasiondiscoverytrojanupx

  • Modifies firewall policy service

    defense_evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2